![\"Hack](\"/static/d9f5b0f1c00cf5945d5d103c87b24897/c8042/327080.png\" "\\"Hack")
\n \n\nThis page has been machine-translated from the original page.
\n
I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.
\n\n \n \n\n This time I am writing up the retired HackTheBox machine “Teacher”.
\n\nThe content of this article is not intended to encourage acts that are contrary to social order.
\nPlease note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).
\nAll statements here are my own and do not represent any organization I belong to.
\n\nAs usual, I started with a port scan.
\n$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.153 $RHOST/g' /etc/hosts\n\n$ nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\nNmap scan report for $RHOST (10.10.10.153)\nHost is up.\nAll 1000 scanned ports on $RHOST (10.10.10.153) are in ignored states.\nNot shown: 1000 filtered tcp ports (no-response)\n\n$ nmap -p- $RHOST -Pn -sC -sV -A | tee nmap_max.txtIt looked like all ports in the fast scan were being filtered.
\nWith everything filtered, it was impossible to tell whether any ports were actually open.
\nI also tried scanning all ports, but unfortunately those were filtered as well.
\nI thought I was completely stuck, but it turned out to be a silly mistake — I simply was not connected to the VPN.
\nAfter connecting to the VPN, I found the following open ports:
\nPORT STATE SERVICE VERSION\n80/tcp open http Apache httpd 2.4.25 ((Debian))\n|_http-title: Blackhat highschool\n|_http-server-header: Apache/2.4.25 (Debian)\n1069/tcp filtered cognex-insight\n1084/tcp filtered ansoft-lm-2\n1085/tcp filtered webobjects\n1434/tcp filtered ms-sql-m\n2222/tcp filtered EtherNetIP-1\n3766/tcp filtered sitewatch-s\n5544/tcp filtered unknown\n5815/tcp filtered unknown\n6004/tcp filtered X11:4\n7402/tcp filtered rtps-dd-mt\n8087/tcp filtered simplifymedia\n8181/tcp filtered intermapper\n9071/tcp filtered unknown\n9099/tcp filtered unknown\n9415/tcp filtered unknown\n9929/tcp filtered nping-echo\n15004/tcp filtered unknown\n32776/tcp filtered sometimes-rpc15\n32782/tcp filtered unknown\n49167/tcp filtered unknown\n65000/tcp filtered unknownFor now, I connected to the open port 80 and continued enumeration.
\nPort 80 appeared to be running some kind of CMS site.
\nSince there were no obvious clues, I ran feroxbuster, which revealed a redirect when accessing the /moodle path.
$ feroxbuster -u http://$RHOST/ -x php -w /usr/share/wordlists/raft-medium-directories.txt --no-recursion | tee feroxbuster.txt\n\n301 GET 9l 28w 317c http://$RHOST/moodle => http://$RHOST/moodle/Opening that address in a browser redirected to http://teacher.htb/moodle/, so I updated the hosts file and accessed the page.
This connected me to what appeared to be a Moodle administration site.
\nI wanted to look for exploits from here, but it turned out that the Moodle version can only be viewed by accounts with teacher-level privileges or higher.
\nReference: Moodle 3.8 - Unrestricted File Upload - PHP webapps Exploit
\nI spent a while trying various exploits from here, but none of them landed.
\nGoing back to enumeration, I noticed that the file images/5.png in the gallery appeared as blank space, which caught my attention.
This gave me a shell, but the privileges were still low, so I continued enumeration from here.
\nBrowsing around, I found DB credentials embedded in a file called config.php.
I extracted a database dump with the following command:
\n$ mysqldump -u 'root' -p -h 'localhost' 'moodle' > /tmp/output.txtGoing through the DB contents, I found that in addition to Giovanni (whose credentials I had obtained), there was an Admin user, and password hashes were stored in the DB.
\nAdmin $2y$10$7VPsdU9/9y2J4Mynlt6vM.a4coqHRXsNTOq/1aA6wCWTsF2wtrDO2\ngiovanni $2y$10$38V6kI7LNudORa7lBAT0q.vsQsv4PemY7rf/M1Zkj/i1VqLO0FSYOI spent a while trying to crack the Admin hash, but on closer inspection I noticed there was another user registered called Giovannibak.
The script looked like this:
\n#!/bin/bash\ncd /home/giovanni/work;\ntar -czvf tmp/backup_courses.tar.gz courses/*;\ncd tmp;\ntar -xf backup_courses.tar.gz;\nchmod 777 * -R;The key observation: after moving to the tmp directory, chmod 777 * -R recursively changes permissions on everything there.
This means that by removing the tmp directory and replacing it with an arbitrary symbolic link, I could cause chmod 777 -R to apply to every file in any target directory.
Any directory would work, but since I wanted to get a shell from backup.sh running as root, I set the symlink as ln -s /usr/bin tmp.
This let me overwrite backup.sh and obtain a root shell.